SOC Analyst

About This Role

This Security Operations Center (SOC) Analyst role involves monitoring, detecting, and analyzing threats and cybersecurity events to identify and defend against validated intrusion events. The analyst will work to support the Incident Response Team by conducting monitoring and analysis during incident management engagements.

Responsibilities

• Monitor, protect, and defend the enterprise perimeter against malicious network traffic
• Monitor, protect, and defend internal networks and hosts against ongoing and emerging threats
• Enrich monitoring logs with contextual operation data from functional areas
• Correlate events and identify security issues, threats, and vulnerabilities
• Conduct security event analysis and validation
• Triage validated incidents
• Perform initial containment where feasible
• Research incidents and enrich incident case documentation
• Escalate incidents for further analysis, containment, and eradication
• Review and analyze threat intelligence information
• Proactively search application, system, and network logs to hunt for and thwart relevant identified threats
• Prepare and perform shift handover briefing to communicate completed and pending activities, and relay situational awareness information
• Contribute to the development and maintenance of SOC Standard Operating Procedures (SOPs) and Concept of Operations (CONOPS) to establish and continuously improve organization operating knowledge base
• Participate in post-incident activities and contribute to lessons learned to improve security operations
• Provide support in preparation of management threat reports and briefings, and recommendations
• Provide sound technical recommendations that enable remediation of security issues
• Partner with security engineering to develop and refine SIEM correlation rules
• Utilize advanced threat models, SIEM use cases, and incident response playbooks

Requirements

• Bachelor’s degree from an accredited college or university with a major in computer science, information systems, engineering, business, or related scientific or technical disciplines
• CompTIA CySA+ certification or a CompTIA Security+ (or other relevant IAT Level II/III Certification) along with one of the following: CEH CFR CCNA Cyber Ops CCNA-Security GCIA GCIH GICSP Cloud+ SCYBER PenTest+
• Experience analyzing intrusion events such as phishing emails, malware, privileges misuse, traffic indicating potential malicious activities such as DoS/DDoS, brute force, data loss through exfiltration/inadvertent disclosure
• Applied experience of threat analysis model/frameworks such as Cyber Kill Chain, MITRE ATT&CK, Diamond Model, Pyramid of Pain etc.